Resolve/Replace NuGet dependencies with vulnerabilities and/or known critical bugs.

[mthomas858]

Hi all,
I noticed the following NuGet packages have vulnerabilities and/or critical bugs based on their NuGet pages:

• Simple.OData.Client.V3.Adapter:
  • Microsoft.Data.OData vr. 5.8.5. Latest known version without vulnerability/critical bug is vr. 5.8.4. https://www.nuget.org/packages/Microsoft.Data.OData
• ActionProviderImplementation:
  • Microsoft.Data.Services.Client vr. 5.8.5 which is dependent on Microsoft.Data.OData vr. 5.8.5, which has a known critical bug.
  • Microsoft.Data.Services vr. 5.8.5 which is dependent on Microsoft.Data.Services.Client vr. 5.8.5 which is dependent on Microsoft.Data.OData vr. 5.8.5, which has a known critical bug.
• Simple.OData.Client.Benchmarks:
  • System.Net.Http vr. 4.3.0 - transitive reference via XUnit vr. 2.4.2. System.Net.Http vr. 4.3.0 has a known vulnerability: https://www.nuget.org/packages/System.Net.Http#versions-body-tab
  • System.Text.RegularExpressions vr. 4.3.0 - transitive reference via XUnit vr. 2.4.2. System.Net.Http vr. 4.3.0 has a known vulnerability: https://www.nuget.org/packages/System.Text.RegularExpressions

Questions:

1. Is anyone looking at updating these project to resolve these dependencies with known vulnerabilities and/or critical bugs?
2. Would someone be willing to give me access/permissions to Simple.OData.Client repo and I can make these changes?

Links to where in code I see the references to the Microsoft.Data.Service.* NuGet packages:

• 45be09a#r136654629